diff --git a/chfs-ng/internal/auth/auth.go b/chfs-ng/internal/auth/auth.go
index f9897fe..34c4744 100644
--- a/chfs-ng/internal/auth/auth.go
+++ b/chfs-ng/internal/auth/auth.go
@@ -186,11 +186,11 @@ type jwtClaims struct {
 	jwt.StandardClaims
 }
 
-func NewToken(username string, timeoutMinutes int) (string, error) {
-	if timeoutMinutes <= 0 {
-		timeoutMinutes = 30
-	}
-	claims := jwtClaims{Acc: username, StandardClaims: jwt.StandardClaims{ExpiresAt: time.Now().Add(time.Duration(timeoutMinutes) * time.Minute).Unix()}}
+func NewToken(username string, _ int) (string, error) {
+	// CHFS v4 keeps the JWT itself valid for one year. session.timeout is
+	// retained as a compatibility configuration field, but it does not alter
+	// the JWT exp claim in the original implementation.
+	claims := jwtClaims{Acc: username, StandardClaims: jwt.StandardClaims{ExpiresAt: time.Now().Add(365 * 24 * time.Hour).Unix()}}
 	token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)
 	return token.SignedString([]byte(jwtSecret))
 }